Do export controls apply to a software-only AI startup?

They can. The Export Administration Regulations reach technology and software, not just hardware, and the obligation attaches to the item's classification rather than to whether you have a warehouse. Most ordinary application software is classified in a way that carries few restrictions, and a great deal of published or publicly available material falls outside the controls entirely. The point is that classification is a determination you are expected to have made, not a status you get by default.

What is a deemed export and why does it matter to an AI team?

Under the deemed export concept, releasing controlled technology to a foreign national inside the United States is treated as an export to that person's country. No shipment and no border crossing is required. AI teams are unusually exposed because the release mechanism is ordinary work — a repository invitation, a cluster credential, a design review, a shared model artifact — and because research teams are frequently international by design.

Are model weights themselves export controlled?

It depends entirely on the model and the current rules, and this is one of the most actively changing areas of the regime. Widely published open-weight models generally sit in a different position than proprietary frontier systems, and policy has moved in both directions. The durable takeaway for a startup is architectural: know which artifacts are proprietary, know where they are stored, know who can pull them, and be able to change that quickly if a classification changes. Companies that cannot answer those questions cannot comply with a rule change no matter what the rule says.

Does selling AI software to overseas customers create export exposure?

Self-serve signup is where this usually bites. Restricted party lists, embargoed destinations and end-use restrictions apply regardless of how small the transaction is, and a credit card form does not screen for any of them. The practical controls are geographic blocking where required, denied-party screening at signup and renewal, and terms that prohibit prohibited end uses — implemented in the product, not only in the contract.

How do cloud regions and GPU access fit into this?

Where compute runs and who can reach it are compliance facts, not just infrastructure choices. A cluster in one region accessed by a contractor in another, a support engineer with production access from abroad, or a partner given a shared environment all create release paths. Map access rather than assets: the question an auditor asks is who could reach the controlled material, not where you intended it to live.

What does a proportionate compliance program look like at seed stage?

Written classification determinations for your core technology, a screening step in signup and vendor onboarding, a documented access model for repositories and compute, a short internal policy, and a named owner. That is achievable in weeks. What regulators and acquirers penalize is not a small program — it is the absence of any documented judgment, because it converts every past decision into an open question during diligence.

AI Export Controls for US Startups: Model Weights, Cloud Access and the Deemed Export Problem (2026)

The Mental Model Is Wrong Before the Facts Are

Export control law in the United States is administered largely through the Export Administration Regulations, which govern items on the Commerce Control List along with a broad residual category covering most other commercial goods, software and technology. Two features of that structure surprise software founders. The first is that "technology" includes information required for development, production or use of a controlled item — designs, specifications, know-how — not merely a compiled artifact. The second is that "export" includes release to a foreign person, wherever that person is standing.

Put those together and the shape of the risk changes completely. A company with no physical product, no international entity and no shipping department can still create an export event by adding an engineer to a repository. That is the deemed export concept, and it has existed for decades in semiconductor, aerospace and encryption contexts. AI has simply made it relevant to a category of company that never had reason to learn it.

Where the Release Actually Happens

Hiring and Team Structure

•Foreign-national research staff granted full repository access on day one
•Offshore contractors and agencies working inside production environments
•Visiting researchers and academic collaborators in design discussions
•Acqui-hired teams whose prior access model was never reviewed
•Interns given the same permission set as full-time engineers

Infrastructure and Compute

•Training clusters reachable from any jurisdiction with a valid credential
•Model checkpoints in buckets with organization-wide read access
•Support and on-call rotations that include staff working abroad
•Shared partner environments provisioned outside the normal access review
•Backups and artifact registries replicated to regions nobody chose deliberately

Go-to-Market

•Self-serve signup with no denied-party or geographic screening
•Resellers and marketplaces placing the product in destinations you never reviewed
•Trials issued to prospects whose end use is unknown and unasked
•Technical documentation gated only by an email address
•Support engineers walking customers through controlled detail on calls

The Structural Failures

•No written classification of the company's own core technology
•Access provisioning owned by whoever is fastest, with no compliance step
•Policy that exists as a slide, with no record of who read it
•No screening at renewal, only at first signup
•Nobody named as owner, so the question surfaces first during diligence

Classification Is a Decision You Are Expected to Have Made

The instinct at a small company is to assume the rules are for someone else and move on. That instinct is usually right on the merits and always wrong on the record. Plenty of AI software falls into low-restriction categories, and material that is genuinely published or publicly available is treated differently from proprietary technology. But those are conclusions, and the regime expects you to reach them deliberately, write them down, and revisit them when the product changes.

The asymmetry is what makes this worth an afternoon. Reaching a documented conclusion that your product is not subject to meaningful restriction costs very little. Having no documented conclusion means that when a customer's security questionnaire, an acquirer's diligence list or a regulator's inquiry arrives, every hire and every integration from the company's history becomes an open question you must reconstruct from memory.

Model Weights: The Part That Keeps Moving

Whether and when trained model weights themselves fall under export restrictions has been among the most contested questions in the regime, and it has moved more than once as policy has shifted between openness and restriction. Chasing the current state of that debate is the wrong project for a startup. The durable move is architectural: keep an inventory of proprietary artifacts, know which storage each one lives in, know precisely who can pull it and from where, and make that access revocable in an afternoon. A company built that way can absorb a rule change. A company where the latest checkpoint is in a bucket everyone can read cannot comply with any rule, current or future.

The Customer Side Nobody Screens

Restricted party lists and embargoed destinations apply to a nineteen-dollar monthly subscription exactly as they apply to a seven-figure enterprise deal. The difference is that the enterprise deal passes through a human who might think about it. Self-serve signup is designed specifically to remove that human. Screening at signup and at renewal, geographic controls where required, and end-use terms enforced in the product rather than only in the contract are the three controls that close the gap — and all three are engineering work, not legal work, which is why they tend to be nobody's priority until they are urgent.

A Program Proportionate to a Startup

Establish the Record

☐Classify your core technology and software in writing, with the reasoning and the date
☐Inventory proprietary artifacts — weights, training data, architecture detail — and where each lives
☐Document the access model for repositories, clusters and artifact stores
☐Write a short policy that names the artifacts and the approval path, and collect acknowledgments
☐Name one owner; rotating responsibility produces no record at all

Make It Hold Under Pressure

☐Add denied-party screening to signup, renewal and vendor onboarding
☐Apply geographic controls in the product where the rules require them
☐Gate access to controlled artifacts through a request that leaves a log
☐Review access on a schedule and at offboarding, including contractors and partners
☐Re-run the classification whenever the product materially changes

None of this is legal advice, and the classification questions genuinely warrant counsel who works in this area. What does not warrant counsel is the operational half: knowing what you have, knowing who can reach it, and being able to prove both. That part is yours, and it is the part that determines whether an export question is a two-hour answer or a three-month reconstruction.

Frequently Asked Questions

We are five people with no international customers. Is this premature?

The customer side may be premature; the team side usually is not. Deemed export exposure is created by who has access to your technology, and a five-person team with one foreign-national engineer already has the fact pattern. The proportionate response at that size is a written classification, a documented access model and a named owner — not a compliance department.

Does publishing our model openly remove the problem?

It changes the analysis substantially for the published material, because genuinely published information sits differently under the regulations than proprietary technology. It does not extend to everything else you hold — unreleased checkpoints, training infrastructure, internal evaluation results and roadmap technology remain proprietary. Publishing one artifact is not a company-wide exemption.

Our engineers are on visas. Can we just not hire foreign nationals?

That is both bad business and a legal hazard of its own. US anti-discrimination rules constrain how citizenship status can factor into hiring, and export compliance is not a blanket license to exclude. The workable approach is scoping access to controlled material and, where required, obtaining authorization — not filtering candidates.

Do our cloud provider's controls cover us?

Their controls cover their obligations, not yours. Region selection, access logging and encryption are useful inputs to your program, but the determination of what your technology is and who may receive it stays with you. Read the shared-responsibility model rather than assuming the platform absorbed the question.

What actually happens if we get this wrong?

Enforcement outcomes range widely, from warning letters through substantial civil penalties and, in serious cases, criminal exposure and denial of export privileges. For most startups the more probable harm arrives sooner and commercially: a failed enterprise security review, a diligence finding that reprices a deal, or a partner declining to integrate.

How does this interact with our privacy and AI governance work?

It shares the same substrate — an inventory of what you hold, a map of who can reach it, and a documented decision about each. Teams that build that substrate once can answer export, privacy, security and AI governance questions from the same source. Teams that answer each regime separately rebuild the same map three times and keep three inconsistent copies.

Your Public Pages Describe Controls You May Not Run

Trust centers, security pages and enterprise FAQs routinely make claims about access control, data residency and who can reach customer systems. Those claims are read by the same reviewers who ask export questions, and a page that overstates your controls is worse than a page that says nothing.

See what your site currently claims. Run a free scan and review every page that describes how access to your systems is controlled.

You Can Violate Export Controls Without Shipping Anything: AI Startups and the Deemed Export Problem